Pinning a dependency to a commit hash, rather than a branch or tag that can move, is one of the oldest tricks in software supply-chain defence: once a plugin has been reviewed and its hash recorded, nothing should be able to change under your feet. AI coding agents adopted the same control for the plugins and skills they install from community marketplaces. AIR's research, which it named Plugin4Shell, found the control was checked in name only: none of the four agents it tested confirmed that the commit actually sitting in the working directory after checkout was the one that had been pinned.
A branch with the right name beats a commit with the right hash
The exploit works because git, when asked to check out a 40-character string that happens to match both a commit hash and a branch name, prefers the branch. Per Help Net Security's write-up, an attacker who controls a plugin repository - including one that already passed review and built up a trusted install base - can create a branch named identically to the commit hash the agent has pinned, point it at the repository's default, and let the agent's own update logic do the rest. Claude Code, Codex and GitHub Copilot are all exploitable this way. Gemini CLI has a variant of the same flaw: it fetches the pinned commit correctly but then runs git checkout FETCH_HEAD, and a repository with a branch literally named FETCH_HEAD causes that checkout to resolve to attacker-controlled code instead.
Zero-click because updates already run without you
Neither variant needs a victim to install anything new. Claude Code and Codex, among others, update installed plugins automatically in the background, so the vulnerable checkout logic re-runs on its own schedule. The Register put the practical consequence plainly: plugins typically inherit the full permissions of the developer account running the agent, which in a lot of organisations means local source, cloud credentials, SSH keys and access to internal repositories and production systems in one step. An attacker doesn't need to compromise a developer - publishing a plausible plugin, waiting for adoption, then rewriting the branch behind an already-pinned hash is enough.
Two patches, one hold-out, one retirement
AIR says it found the bug with working proofs of concept in May 2026 and disclosed to all four vendors in June. The responses since have diverged. Anthropic shipped a fix in Claude Code 2.1.179 in June. OpenAI's fix landed in Codex 0.146.0 in August, confirmed by AIR's own retesting. Microsoft has not patched GitHub Copilot as of this month, despite - per InfoWorld's reporting - Copilot's install base running to roughly 90% of the Fortune 500. Google's response was different again: rather than fix the FETCH_HEAD issue, it confirmed in August that Gemini CLI is being deprecated and will not receive a patch at all, which leaves any organisation still running it exposed indefinitely unless it moves off the tool.
- Don't treat "pinned to a commit hash" as a control you can assume works - Plugin4Shell shows the pin can be recorded correctly and still be silently bypassed at checkout time by the tool enforcing it.
- Inventory which coding agents and which plugin marketplaces your developers actually use, since exposure here depends entirely on the specific agent - Claude Code and Codex on patched versions are no longer vulnerable, unpatched Copilot and any Gemini CLI install still are.
- Where a fix isn't coming, as with Gemini CLI, the practical mitigation is disabling background auto-update for plugins and moving new plugin installs to a reviewed, version-pinned workflow you control rather than the agent's own marketplace.
- Remember what's actually at stake if this is exploited: agent plugins commonly run with the full local and cloud permissions of the developer's own account, so a single compromised plugin can reach source, credentials and production in one step.
The interesting part of Plugin4Shell isn't the AI - it's that a decade-old assumption about how git checkout resolves ambiguous names quietly undermined a control four different vendors all built independently. If you want help auditing which coding agents and plugin sources your engineering teams are actually running, email sales@halfteck.com.